Korean crypto exchange Pravang halts services after 100 million won hot wallet hack

South Korean crypto exchange Pravang has suspended services after detecting abnormal withdrawals from its hot wallet, an internet-connected exchange wallet. Losses identified so far total about 100 million won. In an apology posted on its website on Oct. 26, Pravang Co. said a security breach occurred around Oct. 24 through access by an unauthorized outside party, and that it had temporarily halted services to protect members' assets. The company said it would determine the exact losses and cover them in full with company funds.

Pravang is a so-called coin market exchange, where crypto assets trade only against other crypto assets, without supporting Korean won deposits or withdrawals. As of Oct. 29, its website showed only the apology notice instead of the trading screen.

Withdrawals detected Oct. 24, apology issued two days later

According to the company, Pravang activated its emergency response system right after detecting the abnormal withdrawals from its hot wallet on Oct. 24 and ran a full inspection of the exchange's systems. That review uncovered a security vulnerability, and services were halted. The company said it had reported the incident to the relevant authorities as required by law and is investigating the cause and scale. The notice does not say which coins were taken, in what amounts, or when services will resume.

1. Oct. 2An unauthorized outsider obtains personal data of 20 members (reported by Money Today Broadcasting)
2. Oct. 14Financial Services Commission names 16 financial firms with confirmed breaches; the crypto operators on the list were Streami (operator of Gopax) and Pravang
3. Oct. 24Pravang detects abnormal withdrawals from its hot wallet and activates its emergency response
4. Oct. 26Pravang posts apology: about 100 million won in losses, services temporarily suspended, full compensation planned
5. Oct. 28Financial Services Commission holds emergency meeting on crypto-sector breaches with Bithumb and others

"We plan to accurately identify members' lost assets and take measures to cover them in full with company assets."

Pravang Co. apology notice

Personal data of 20 members leaked on Oct. 2

The hot wallet incident is Pravang's second breach this month. The Financial Services Commission (FSC), South Korea's top financial regulator, said at its second emergency response meeting on Oct. 14 that 16 financial companies across banking, savings banks, virtual asset service providers and other sectors had confirmed breaches around the time of a breach at Shinhan Bank. Streami and Pravang were the two from the crypto sector. The total volume of information exposed in the breaches confirmed at that point was about 100,000 records.

According to Money Today Broadcasting, an unauthorized outsider obtained 12 categories of information on 20 Pravang members on Oct. 2, including name, gender, nationality, date of birth, contact details, address and workplace. Pravang said at the time that it had blocked the IP address involved and checked and patched vulnerabilities on its website. At Gopax, which Streami operates, there were attempts to log in to customer accounts using email addresses and passwords apparently leaked from other sites, with no loss of customer assets, the same report said.

Regulator holds emergency meeting with Bithumb over security breaches

The FSC held an emergency meeting on crypto-sector breaches on Oct. 28, chaired by Yoo Young-joon, its director general for digital finance policy, with the Financial Supervisory Service (FSS), the Financial Security Institute, the Digital Asset eXchange Alliance (DAXA) and Bithumb. According to the FSC, Bithumb reported that it had found signs that information on employees of Bithumb, its subsidiaries and partner companies had leaked through abnormal outside access, and that it was still checking whether user data was affected. Bithumb said the compromised system supported employees' work rather than core crypto trading infrastructure, and that no leak of information such as crypto wallet addresses that could be used for fraudulent payments or asset transfers had been confirmed so far.

The FSC, FSS and Financial Security Institute have begun on-site investigations and will oversee the implementation of consumer protection measures, including full compensation if losses occur, the FSC said. It added that it would push to raise security standards in sectors not covered by the Electronic Financial Transactions Act, such as crypto, to the level of banks.

Cold storage and insurance are legal requirements

South Korea's Virtual Asset User Protection Act requires exchanges to keep a prescribed minimum proportion of users' crypto assets in offline storage, separated from the internet. Its enforcement decree leaves the FSC to set that share by notice, at no less than 70%. The same law obliges operators to buy insurance or mutual aid coverage, or set aside reserves, to meet their liability for incidents such as hacking and system failures. Pravang said only that it would compensate affected members from company assets.